SOC 2 · HIPAA · ISO 27001
Get a clear plan, founder-led support, and an AI agent that helps prepare policies and collect evidence. Keep your team focused on building while you work toward your audit.
30 minutes with the founder · Written next steps · No purchase required
SOC 2
HIPAA
ISO 27001
ISO 42001
GDPRAnimated product demo: Screenata scans your systems, assesses SOC 2 readiness, remediates gaps, collects your review and sign-off, and delivers a signed audit package to your auditor.
A person to turn to
Your team gets a shared Slack channel with Screenata’s founder for setup questions, product help, and blockers. We agree support hours and check-in times during onboarding.
01
Start with the customer request, your systems, and your target date. Agree what the platform, your team, and any partner will cover.
02
Connect your systems. Vera drafts policies and gathers evidence; we help you work through setup and the next actions. Your team reviews and approves.
03
Check readiness and organize the evidence package. Your independent auditor reviews the evidence and issues the report.
Your team provides access and accurate information, reviews and approves policies, operates its controls, and fixes infrastructure gaps. Your independent auditor decides whether the evidence is sufficient and issues the report.
Infrastructure remediation, advisory beyond the agreed program, and hands-on audit fieldwork support are scoped separately with a delivery partner when needed. The independent audit fee is separate.
Vera writes the policies, collects the evidence, works through the gaps with your team, and assembles a signed audit package. You approve; your auditor issues the report.
Your compliance program
Every module included.
Scope agreed before signing
Policies, evidence, monitoring, and audit preparation in one program. We work through your scope and support needs with you, then put the proposal in writing.
okta-mfa.json
Jun 30, 06:00 · Okta API
Every artifact is mapped to a control, dated, and signed, so any auditor can verify it independently. When an enterprise buyer's security team reads it line by line, the proof holds up.
“I really like… the focus on reducing manual work instead of just giving users another compliance dashboard to manage. The AI agent approach… feels more like having an assistant working with you instead of just showing you tasks.”
01 · Policies
Vera assembles context from GitHub, AWS or GCP, your IdP, and existing evidence before a single policy is written. The overpromise checker flags hard commitments unsupported by what she found, before your auditor does.
Acme Corp enforces multi-factor authentication through Okta for all administrative access to production systems. verified
Production access is reviewed quarterly by the security team to remove stale entitlements. overpromise
Vera flagged this claim
No quarterly access review evidence found in the last 12 months across Okta and GitHub. Soften to "periodic reviews as needed", or commit to quarterly and let me schedule them.
02 · Evidence
API integrations are table stakes and cover about 30–40% of a SOC 2. The rest lives in screens and walkthroughs that other platforms hand back to you as a to-do list. Screenata captures those too, and evidence collected once counts toward every framework it satisfies.
01
Cloud, code, and identity providers scanned on a schedule. Every check maps to a control and is signed on arrival.
What every platform does.
Providers
Okta
AWS
GitHub
Google Cloud
DatadogChecks running
Controls satisfied
02
Settings pages and admin consoles with no API, the evidence teams still screenshot by hand. Click the extension, or let a procedure trigger it on schedule. Captured, redacted, quality-checked, signed, filed.
Where most platforms hand the work back to you.
What happens next
03
Multi-step work with an owner per step, proof attached as you go, and a sign-off at the end. The run itself becomes the signed evidence record.
Where most platforms hand the work back to you.
Quarterly schedule
Restore snapshot to staging
Sarah logCompare row counts
Running…2,418,902Counts match?
CTO signs off
MarcusPendingWaitingSigned record
A1.2Open incident
Vera: Counts match on both sides. Routed to Marcus for sign-off.
Plus inbox ingestion: forward an email or drop a file in Slack and it files itself.
The evidence collector extension03 · Slack & email
Your team shouldn't have to sign in to one more platform to finish a request. Files dropped in Slack or emailed to your workspace address are filed as evidence and matched to the right test. Nobody has to open the dashboard.
compliance
8 members · pinned: SOC 2 program
Daily compliance briefing · Mon Apr 28
Weekly cloud scan · 500 checks
04 · Proof
Screenata links each policy sentence to the control it satisfies, the test that checks it, and the signed evidence that proves it. Your team can see why a requirement exists and exactly what proves it. Your auditor can verify the artifact outside Screenata.
Policy sentence
Administrative access requires MFA through Okta.
Access Control Policy / §3.2
Policy claim
MFA enforced for admin accounts
CC6.1 · IA-2 · IMPLEMENTED
Control test
Okta MFA policy verification
Native API check · 24h freshness
Evidence artifact
Signed Okta API response
SHA-256 + RFC 3161 timestamp
How it runs
Scheduled agents do the checking, following up, and filing. You approve the parts that need a human.
Monday · 6:00 AM
Checks run across AWS or GCP, GitHub, and your identity provider. Every result maps to a control.
Every day · 6:00 AM
Each artifact is checked against its window. Fresh, stale at 90 days, expired at 120.
Every day · 6:30 AM
Readiness, blockers, and the one thing to do next, posted where the team already reads.
Every day
Owners get a reminder before a test is due and an alert when it's late. Work nobody owns routes to the test's owner role.
When a check fails
Each failing check comes with the recommended fix and the steps to apply it. The finding closes on its own once the nightly re-check passes.
Audit window
Policies, evidence, and a manifest. Your auditor verifies the signatures independently.
Also included
Trust Center, vendor management, questionnaires, and the rest. Included in the price, not sold as line items.
Cloud, code, and identity scans on a schedule. One check counts toward every framework it maps to.
Onboarding, training, and policy acknowledgments per employee.
Laptops, cloud resources, and SaaS accounts with owner and encryption state.
contractor@ext.io
Admin · idle 71d
Quarterly reviews pulled, routed for approval, and filed by Vera.
A public page built from live evidence. Prospects stop emailing for the report.
Every vendor with a risk tier, DPA status, and their own SOC 2 report.
Yes. AES-256 on all RDS and S3.
Sourced from CC6.7
Answers drafted from your controls, with the control ID attached.
RSK-002
Ransomware on production
Inherent 20 · Residual 8
Findings from Wiz, CrowdStrike, AWS Security Hub, Snyk, and GitHub land here with severity and the affected system.
A read-only view of controls, evidence, and the signed pack for the auditor you pick.
Review the evidence for yourself
Review our security practices, inspect how evidence is signed, and ask us to walk through an evidence export. Your audit firm stays independent.
Cloud provider keys live in Azure Key Vault, retrieved at scan time, never cached or logged. A breach of us is not a breach of you.
No write scopes on your repos or cloud. Source code is scanned in memory and never persisted. We cannot change your infrastructure, by design.
RSA/ECDSA signatures, RFC 3161 timestamps, SHA-256 manifests, BYOK. An open spec and a free verify CLI, no account needed.
Your compliance program
A free 30-minute readiness review with Screenata’s founder, based on your customer requirement, current setup, and target date. Get a written summary of scope, priority gaps, and next steps. No purchase or system access required.
Clear scope. Named responsibilities. A proposal in writing.
Your scope
Frameworks, entities, infrastructure, and the deadline you’re working toward.
Our support
Founder-led onboarding, a shared Slack channel, and a practical evidence plan.
Your proposal
Platform, onboarding, responsibilities, and renewal terms agreed before signing.
Your auditor
Choose and contract with an independent audit firm directly.
FAQ
The free review, human support, your responsibilities, and the work Vera handles.
A free 30-minute readiness review with Screenata’s founder, based on your customer requirement, current setup, and target date. Get a written summary of scope, priority gaps, and next steps. No purchase or system access required. This is an initial review based on what you share, not an audit or a complete verification of your controls. If Screenata fits, we can also provide a scoped proposal.
Your team gets a shared Slack channel with Screenata’s founder for setup questions, product help, and blockers. We agree support hours and check-in times during onboarding.
Your team connects systems, provides accurate information, reviews and approves policies, operates controls, and fixes infrastructure gaps. Screenata helps prepare policies, collect evidence, and organize the next actions. If you need hands-on implementation or specialist advice, we can discuss a separately scoped delivery partner engagement.
We review your scope, existing controls, evidence gaps, and team availability before agreeing milestones. A SOC 2 Type II also requires an observation period agreed with your auditor. Your independent auditor determines whether the evidence is sufficient and issues the report; the free readiness review does not guarantee an audit outcome or completion date.
Evaluate the work each product handles for your actual setup. Screenata combines infrastructure-grounded policies, evidence collection through integrations and guided procedures, and founder-led onboarding. Ask us to demonstrate one of your evidence tasks and clarify what your team still needs to do.
Screenata scans first, then writes. We pull context from GitHub, AWS or GCP, your IdP, existing evidence, and your company profile, then generate policies grounded in what we found. The overpromise checker flags hard commitments (like 'quarterly access reviews') we cannot verify in evidence, before you ever ship them to an auditor.
Three channels, not one. API scans cover about 30–40% of a SOC 2 across cloud, code, and identity providers. The browser extension captures screenshots of settings pages and workflows, redacts sensitive fields, runs a vision quality check, signs the capture, and re-captures it on a schedule. Guided procedures walk a teammate through steps like a backup restore test and record results and attachments as they work. Your team reviews the output and supplies context where a task requires human judgment.
We review your frameworks, entities, infrastructure, and support needs, then put the scope, price, and responsibilities in writing. The free readiness review has no purchase requirement. You choose and pay your independent auditor separately.
No. Every test explains what to provide, which evidence items are required, and how your auditor will judge it, and you can ask Vera about any requirement in plain language. The lineage view traces a policy, claim, control, or test through to the evidence that proves it, so you can see why something is required. When a check fails, it comes with the recommended fix and the steps to apply it, and the finding closes on its own once the nightly re-check passes.
Start with a free readiness review
A free 30-minute readiness review with Screenata’s founder, based on your customer requirement, current setup, and target date. Get a written summary of scope, priority gaps, and next steps. No purchase or system access required.
